Posted by Shahar Epstein on Sep 29 Severity: low Affected versions: - Apache Airflow Google provider before 22.6.0 Description: Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string literals, without escaping the quote character that delimits them. A name containing an apostrophe therefore terminated the literal early and appended clauses of the attacker's choosing to the...
CVE-2026-81914: Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names
About this summary. This is a short, independently written summary of an article first published by oss-security. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q3/985
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Malicious Custom GPT on chatgpt.com lures users into installing a RAT
Malware peddlers are using sponsored Google results to push a malicious ChatGPT Custom GPT named “Plus 5.6,” created to lead users to a fake Cloudflare CAPTCHA check…
Claude Sonnet 5.5 gets faster without a price hike
Anthropic has released Claude Sonnet 5.5, an AI model for coding and office work. The company says it responds more than 30% faster than its predecessor and uses fewer…
Long Term Support Channel Update for ChromeOS
A new LTS version 144.0.7559.264 (Platform Version: 16503.97.0), is being rolled out for most ChromeOS devices. Release notes for LTS-144 can be found here Want to know…
Chrome Store Hosts 'Poper Blocker' Spyware Downloaded by Millions
A purported ad-blocker exfiltrates reams of sensitive information, and benefits from having Google's stamp of approval despite researcher warnings.
How fast is the web? Explore billions of real-user measurements with BEACON
If you work in technology, you’re probably reading this on a powerful laptop or flagship mobile on robust, lightning-fast Wi-Fi. This is fantastic for building software…
Supporting native Rust in Workers with the new Emscripten target for wasm-bindgen
Today we’re announcing the first public experimental preview of a feature to better support native Rust code and even Tokio-based applications just running natively on…